# Search for Fields Containing Multiple Lines with Regexp

**URL:** <https://discuss.elastic.co/t/search-for-fields-containing-multiple-lines-with-regexp/103414>\
**Category:** Elasticsearch\
**Created:** [October 10, 2017, 5:57pm UTC](https://discuss.elastic.co/t/search-for-fields-containing-multiple-lines-with-regexp/103414 "2017-10-10T17:57:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cb2015](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@cb2015](https://discuss.elastic.co/u/cb2015)\
**Post date:** [October 10, 2017, 5:57pm UTC](https://discuss.elastic.co/t/search-for-fields-containing-multiple-lines-with-regexp/103414/1 "2017-10-10T17:57:42Z")

</div>

Hi All,

I have this query that I am working on:

```
GET web-jsp-2017.10.04/_search
{
  "query" : {
    "regexp": {
      "stacktrace":{
        "value" : "java.net.socket.+",
        "flags": "ALL"
      }
    }
  }
}

```

This will return this as a result

```
      {
        "_index": "web-jsp-2017.10.04",
        "_source": {
          "container": "px-web-jsp",
          "source_host": "bos1px-app1",
          "level": "ERROR",
          "exception_class": "java.net.SocketTimeoutException",
          "message": "Could not obtain raw response from reporting service",
          "mdc": {},
          "exception_message": "Read timed out",
          "path": "/es_data1/prodcburke_data/app1",
          "@timestamp": "2017-10-04T14:09:29.861Z",
          "stacktrace": """
java.net.SocketTimeoutException: Read timed out
	at java.net.SocketInputStream.socketRead0(Native Method)
	at java.net.SocketInputStream.read(SocketInputStream.java:152)
	at java.net.SocketInputStream.read(SocketInputStream.java:122)
    ...

```

This is great, however, I want my queries to be able to find only stacktrace fields that would match a grep such as

`grep 'java.net.SocketTimeoutException(.+\n)+.+java:152.+'`

If I put that regex into the "value" field in my query above I get no results back. Could someone help me figure out what I am doing wrong? I just want to search through my index using regex.

(For those interested, I will actually be using this query to delete docs that match a blacklist I maintain which is composed of several hundred regexes)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 5:57pm UTC](https://discuss.elastic.co/t/search-for-fields-containing-multiple-lines-with-regexp/103414/2 "2017-11-07T17:57:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.